topic Re: split function in calculated fields in Splunk Search

split function in calculated fields

AlexeyNL — Mon, 28 Oct 2013 11:04:54 GMT

When i try to save in Splunk Web calculated fields that contains split function i have a "Encountered the following error while trying to save: In handler 'props-eval': Bad function" message.
Why i can't use this function in calculated fields?
There is no word about this limitation here in Splunk Documentation,
Examples of Eval expression that are not working:

split(anyfield,";")

split("x:x",":")

But in conjunction with eval in Search these are working fine.

Splunk Version............................................6.0
Splunk Build............................................182037

Re: split function in calculated fields

alacercogitatus — Mon, 28 Oct 2013 11:21:34 GMT

Can you edit and put your calculated input definition?

Re: split function in calculated fields

mklunder — Sat, 14 Dec 2013 21:01:58 GMT

I have also encountered the same issue. In my case I am adding the eval below in the web UI (6.0).

Expression:
mvcount( SPLIT(nodes, ",") )

Returns:
Encountered the following error while trying to save: In handler 'props-eval': Bad function

Re: split function in calculated fields

joebensimo — Mon, 10 Mar 2014 03:30:26 GMT

I too am having this problem when I use split is calculated fields. Eg: split(field," ")

Re: split function in calculated fields

joebensimo — Tue, 11 Mar 2014 16:26:34 GMT

This appears to only be a limitation in the user interface. I have successfully added (and use) calculated fields that use split by directly adding them to a props.conf file.

For example:

[source::users*ly]
EVAL-userid = split(userid," ")